Fix ASSERT violation when BinaryOpIC::Transition recurses into itself

src/ic.cc

Index: src/ic.cc
diff --git a/src/ic.cc b/src/ic.cc
index f1e3c5539d64fbd9f74cc0de671edc62a2cb3db6..335e687c0b50070c0889cf3bae0de83884962121 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -2404,8 +2404,11 @@ MaybeObject* BinaryOpIC::Transition(Handle<AllocationSite> allocation_site,
       isolate(), function, left, 1, &right, &caught_exception);
   if (caught_exception) return Failure::Exception();
 
+  // Execution::Call can execute arbitrary JavaScript, hence potentially
+  // update the state of this very IC, so we must update the stored state.
+  UpdateTarget();
   // Compute the new state.
-  State old_state = state;
+  State old_state(target()->extra_ic_state());
   state.Update(left, right, result);
 
   // Check if we have a string operation here.